CVE-2005-3208
aenovo - SQL Injection via Password Parameter in control.asp
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2005-3208. PoCs published by farhad koosha.
AI-analyzed exploit summary This is a proof-of-concept for an SQL injection vulnerability in Aenovo, aeNovoShop, and aeNovoWYSI applications. The exploit demonstrates a login bypass by injecting malicious SQL input into the password field of a login form.
Description
Multiple SQL injection vulnerabilities in (1) aeNovo, (2) aeNovoShop and (3) aeNovoWYSI allow remote attackers to execute arbitrary SQL code via (a) the password parameter in control.asp, and (b) the strSQL parameter in search.asp, which can enable XSS attacks in resulting error messages.
Exploits (2)
This is a proof-of-concept for an SQL injection vulnerability in Aenovo, aeNovoShop, and aeNovoWYSI applications. The exploit demonstrates a login bypass by injecting malicious SQL input into the password field of a login form.
The provided text describes SQL injection vulnerabilities in Aenovo, aeNovoShop, and aeNovoWYSI applications due to improper input sanitization. It includes an example URL demonstrating how an attacker could exploit the vulnerability to retrieve administrator credentials.